Hi,
currently we have three OpenLDAP servers in multi-master mode and with MemberOf .
Currently, the base DN is dc=oldorgname,dc=de. The name of the organization changed and all entries should be accessable through base dc=neworgname,dc=de and all attributes with DNs as value shall return this new base.
First I tried relay with rwm in this configuration:
dn: cn=module{1},cn=config changetype: modify add: olcmoduleload olcModuleLoad: back_relay.la
dn: olcDatabase={2}relay,cn=config changetype: add objectClass: olcRelayConfig olcSuffix: dc=neworgname,dc=de olcRelay: dc=oldorgname,dc=de
dn: olcOverlay=rwm,olcDatabase={2}relay,cn=config changetype: add objectClass: olcRwmConfig olcRwmRewrite: rwm-suffixmassage "dc=oldorgname,dc=de"
But this caused slapd to dump core at different entries, when I query the whole database as administrator pulling all attributes. As this module is "experimental", so I went another way.
Should I try another config?
Second, I tried to create a consumer server with a separate database using and suffixmassage.
olcSyncrepl: {2}rid=004 provider=ldap://server:389/ bindmethod=simpl e binddn="cn=dn" credentials="pwd" s earchbase="dc=oldorgname,dc=de" scope=sub schemachecking=on type=re freshAndPersist retry="5 2 30 2 60 +" interval=00:00:00:30 timeout=0 network-time out=0 keepalive=0:0:0 attrs="*,+" suffixmassage="dc=neworgname,dc=de"
The sync proceeded, but I ended with uniqueMember attributes with the old base:
dn: cn=team,ou=groups,dc=ou,dc=neworgname,dc=de uniqueMember: uid=user,ou=peolple,dc=ou,dc=oldorgname,dc=de
The value of the attribute "member" gets rewritten into the new orgname.
Ist this a bug or intentional behaviour?
Kind regards,
Attribute 'uniqueMember' has LDAP syntax "Name And Optional UID" (1.3.6.1.4.1.1466.115.121.1.34). I would not expect slapo-memberof and slapo-rwm's rwm-suffixmassage to work with that.
Use group entries based on groupOfNames with attribute 'member' instead.
Ciao, Michael.
On 07/26/2018 02:41 PM, Steffen Kaiser wrote:
currently we have three OpenLDAP servers in multi-master mode and with MemberOf .
Currently, the base DN is dc=oldorgname,dc=de. The name of the organization changed and all entries should be accessable through base dc=neworgname,dc=de and all attributes with DNs as value shall return this new base.
First I tried relay with rwm in this configuration:
dn: cn=module{1},cn=config changetype: modify add: olcmoduleload olcModuleLoad: back_relay.la
dn: olcDatabase={2}relay,cn=config changetype: add objectClass: olcRelayConfig olcSuffix: dc=neworgname,dc=de olcRelay: dc=oldorgname,dc=de
dn: olcOverlay=rwm,olcDatabase={2}relay,cn=config changetype: add objectClass: olcRwmConfig olcRwmRewrite: rwm-suffixmassage "dc=oldorgname,dc=de"
But this caused slapd to dump core at different entries, when I query the whole database as administrator pulling all attributes. As this module is "experimental", so I went another way.
Should I try another config?
Second, I tried to create a consumer server with a separate database using and suffixmassage.
olcSyncrepl: {2}rid=004 provider=ldap://server:389/ bindmethod=simpl e binddn="cn=dn" credentials="pwd" s earchbase="dc=oldorgname,dc=de" scope=sub schemachecking=on type=re freshAndPersist retry="5 2 30 2 60 +" interval=00:00:00:30 timeout=0 network-time out=0 keepalive=0:0:0 attrs="*,+" suffixmassage="dc=neworgname,dc=de"
The sync proceeded, but I ended with uniqueMember attributes with the old base:
dn: cn=team,ou=groups,dc=ou,dc=neworgname,dc=de uniqueMember: uid=user,ou=peolple,dc=ou,dc=oldorgname,dc=de
The value of the attribute "member" gets rewritten into the new orgname.
Ist this a bug or intentional behaviour?
Kind regards,
-- Michael Ströder Klauprechtstr. 11 Dipl.-Inform. D-76137 Karlsruhe, Germany Tel.: +49 721 8304316 Mobil: +49 170 2391920 E-Mail: michael@stroeder.com https://www.stroeder.com
openldap-technical@openldap.org
-
Michael Ströder -
Steffen Kaiser